Subject: Re: [hrpc] [gaia] practical considerations about security implementation

From: "Eggert, Lars" <[email-masked]>
Date: Fri, 7 Aug 2015 07:43:15 +0000

CC'ing [email-masked] and setting reply-to

On 2015-08-06, at 18:42, Daniel Formolo <[email-masked]> wrote:
> 
> Dears, I read "Human Rights Protocol Considerations Glossary draft-dkg-hrpc-glossary-00", it seems good, but I have some technical considerations. We can work hard implementing new features in protocols to improve connectivity (interoperability, resilience, reliability, robustness). That is feasible.
> 
> But, security (resilience, reliability, confidentiality, anonymity, authenticity), is in general broken in application layer. Most cases people uses final software insecurely. I am afraid that much technical effort will put to improve security in middleware but most of security problems will continues due to wrong use of software by people. Maybe the focus to security at first moment must be in application layer and good patterns of final software to avoid people get mistakes.
> 
> 
> kind regards.
> 
> Daniel Formolo.
> _______________________________________________
> gaia mailing list
> [email-masked]
> https://irtf.org/mailman/listinfo/gaia

---

From: Niels ten Oever <[email-masked]>
Date: Fri, 07 Aug 2015 13:17:18 +0200

Hi Daniel,

Thanks for this. You are completely right in saying that there are
regular occurrences of significant security problems in the
application layer, but that doesn't mean that that are no problems on
lower layers, right? The chain is as strong as its weakest link.

Nick Doty wrote a real interesting paper about privacy and security
and standards which might be of your interest:
https://npdoty.name/privacy-reviews/iwpe/

Or RFC3552 which described the guidelines for security considerations
: https://www.ietf.org/rfc/rfc3552.txt

With the great quote in there:

Most people speak of security as if it were a single monolithic
   property of a protocol or system, however, upon reflection, one
   realizes that it is clearly not true.  Rather, security is a series
   of related but somewhat independent properties.  Not all of these
   properties are required for every application.

Best,

Niels

Niels ten Oever
Head of Digital

Article 19
www.article19.org

PGP fingerprint    8D9F C567 BEE4 A431 56C4
                   678B 08B5 A0F2 636D 68E9

On 08/07/2015 09:43 AM, Eggert, Lars wrote:
>> Dears, I read "Human Rights Protocol Considerations Glossary 
>> draft-dkg-hrpc-glossary-00", it seems good, but I have some 
>> technical considerations. We can work hard implementing new 
>> features in protocols to improve connectivity (interoperability, 
>> resilience, reliability, robustness). That is feasible.
>> 
>> But, security (resilience, reliability, confidentiality,
>> anonymity, authenticity), is in general broken in application
>> layer. Most cases people uses final software insecurely. I am
>> afraid that much technical effort will put to improve security in
>> middleware but most of security problems will continues due to
>> wrong use of software by people. Maybe the focus to security at
>> first moment must be in application layer and good patterns of
>> final software to avoid people get mistakes.
>> 
>> 
>> kind regards.
>> 
>> Daniel Formolo. _______________________________________________ 
>> gaia mailing list [email-masked] 
> _______________________________________________ hrpc mailing list 
> [email-masked] https://www.irtf.org/mailman/listinfo/hrpc
>

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 25 Aug 2015 20:46:22 +0200

On Fri, Aug 07, 2015 at 01:17:18PM +0200,
 Niels ten Oever <[email-masked]> wrote 
 a message of 87 lines which said:

> there are regular occurrences of significant security problems in
> the application layer, but that doesn't mean that that are no
> problems on lower layers, right? The chain is as strong as its
> weakest link.

Also, we cannot solve all the problems of mankind, or even the more
limited problem of computer security. IETF/IRTF is in charge of the
infrastructure, not the user interface or user training. Let's be
modest and focus on our job.